Program on Extremism 


THE GEORGE WASHINGTON UNIVERSITY 


THE ISLAMIC STATE’S EFFORT TO 
CO-OPT TANZIM HURRAS AD-DIN 


ASAAD ALMOHAMMAD 
NOVEMBER 2019 


GW Program on Extremism - extremism.gwu.edu - @gwupoe 


ALMOHAMMAD | PROGRAM ON EXTREMISM 


About the Program on 
Extremism 


The Program on Extremism at George 
Washington University provides 
analysis on issues related to violent 
and non-violent extremism. The 
Program spearheads innovative and 
thoughtful inquiry, 
producing work that 
strengthens extremism research as a 
distinct field of study. The Program 
aims to develop pragmatic policy 


academic 
empirical 


solutions that resonate with 
policymakers, civic leaders, and the 


general public. 


THE ISLAMIC STATE’S EFFORT TO CO-OPT TANZIM HURRAS AD-DIN EA 


About the Author 


Dr. Asaad Almohammad is a Senior 
Research Fellow with the Program on 
Extremism at George Washington 
University. He has spent several years 
coordinating and working on research 
projects across ISIS-held territories in 
Syria and Iraq. Using primary sources, 
he has examined a number of 
administrative, operational, and military 
trends of jihadi organizations. He has 
published on a wide variety of topics 
relating to these themes, including 
middle management structure, media 
production and information security, 
intelligence and counterintelligence 
operations, improvised use of 
technology, child soldiering, prison 
system and terrorists’ use of enhanced 
interrogation methods, and 
radicalization leading to violence. He 
completed his doctorate in political 
psychology and marketing. Dr. 
Almohammad is a former national 


security practitioner. 


ALMOHAMMAD | PROGRAM ON EXTREMISM 


Abstract 


Based on data gathered from eastern and northwestern Syria between J anuary 2018 and 
April 2019, the author investigated the Islamic State’s covert operation to infiltrate and 
fold Tanzim Hurras ad-Din (Guardians of Religion Organization), an unofficial al- 
Qaeda affiliate, under its banner. Evidenced by internal documents and interview 
materials, this paper argues that the Islamic State has orchestrated and implemented 
this multifaceted operation since at least mid-J anuary 2017. In the run-up to territorial 
defeat in eastern Syria, the Islamic State signaled its interest in relocating its operatives 
to Idlib. The group also developed scenarios to facilitate the movement of its members 
to northwest Syria in the case of territorial defeat. With the potential of a reduction in 
counterterrorism efforts against the Islamic State, such a plan, if implemented 
successfully, may allow the organization to put a contingency plan into action, one that 
facilitates its effort to regroup and rebuild its depleted capacities in Syria. This paper 
utilizes and demonstrates the value of the tribe building method in gathering data in 


WarZones. 


Introduction 


Making use of texts and audio-visual materials gathered from east and northwest Syria 
between J anuary 3, 2018, and April 27, 2019, this article investigates the Islamic State’s 
(IS) attempted/ ongoing co-optation of Tanzim Hurras ad-Din (Guardians of Religion 
Organization, THD), an unofficial al-Qaeda (AQ) affiliate. Specifically, the author 
introduces the mechanism IS used in its operation to co-opt THD, including eliminating 
threats from diehard AQ loyalists, building institutional capacity, placing its agents in 
leading positions within the ranks of THD, and enforcing measures of organizational 
alignment between the two groups. In so doing, this effort presents a useful method for 
studying insurgent organizations’ covert operations. 


The paper identifies key details about the formation of THD and IS’ operations to co-opt 
this unofficial AQ affiliate in the months leading up to IS’ territorial collapse. The results 
show that IS had poured resources and manpower into THD for over a year before the 
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group announced its formation. According to internal IS documents obtained by the 
author, this operation started no later than mid-January 2017. Taken altogether, this 
effort demonstrates the invaluable insight gained from field research. This paper 
employs ‘tribe building,’ outlining a useful approach to better understand the operations 
of covert terrorist organizations.! In the following pages, the author provides the 
necessary background and guiding method. Through subsequent sections, the paper 
illustrates capacity building efforts and a multifaceted IS contingency plan to regroup 
and rebuild its organizational capabilities. 


Background 


The formation of THD in northwest Syria was announced on February 27, 2018.2 The 
group itself did not claim an international agenda and so far has not been named as an 
official AQ affiliates However, an assessment by the Dutch Intelligence and Security 
Service argued that THD has “open links to al-Qaeda and a specific focus on the 
international jihadist agenda.”* While that analysis did not detail the sources and 
methods used in arriving at these conclusions, it is noteworthy that THD is led by AQ 
loyalists who opposed severing the ties between AQ and its former Syrian affiliate, 
Hayat Tahrir al-Sham (HTS, a.k.a., Jabhat Fateh al-Sham and Jabhat al-Nusra).5 
THD also places itself under AQ’s leadership and ideological outlook. Moreover, it is 


1 Malejacg, Romain, and Dipali Mukhopadhyay. "The ‘tribal politics’ of field research: A reflection on 

power and partiality in 21st-century warzones." Perspectives on Politics 14, no. 4 (2016): 1011-1028. 

2 Thomas J oscelyn, “Jihadists form ‘Guardians of the Religion’ organization in Syria,” March 4, 20 18, 

FDD’s Long War Journal, https: - 

of-the-religion-organization-in-syria. php. While new materials suggest that THD was not nared before 

January 2018, documents obtained by the author evidence that THD was named no later than mid- 

January 2017. To review this newly released materials, please see: Aymenn Al-Tamimi, “The Hay'at Tahrir 

al-Sham-al-Qaeda Dispute: Primary Texts (XII),” Pundicity, February 7, 2019, 

http://www.aymennjawad.org/ 2019/ 02/ the-hayat-tahrir-al-sham-al-qaeda-dispute-primary- 11. 

3 Ibid. 

4 General Intelligence and Security Service (AIVD), “The legacy of Syria - Global jihadism remains a threat 

to Europe,” AIVD, November 9, 2018, https: Hl english. aivd.nl/ binaries! aivd- 
bal-ji ~a- thr 


europe/ See ae eee pdf: P. 14. 


5 Lister, Charles. "How Al-Qaida Lost Control of Its Syrian Affiliate: The Inside Story." CTC Sentinel 11, 
no. 2 (2018): P. 1-9; and Tore Refslund Hamming and Pieter Van Ostaeyen “The True Story of al-Qaeda’s 
Demise and Resurgence in Syria,” Lawfare, April 8, 2018, https:// www.lawfareblog.com/ true-story-al- 


qaedas-demise-and-resurgence- syria. 
6 Hamming and Van Ostaeyen (2018). 
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argued that several THD leaders were involved with the Khorasan Group, a former AQ 
group charged with plotting foreign terrorist attacks from Syria.” Other leaders of THD 
are thought to have been dispatched by Ayman al-Zawahiri, the current leader of al- 
Qaeda, from Afghanistan, Iran, and Yemen.® Additionally, the formation and emergence 
of THD is likely a response to the escalating schism between HTS and AQ.9 HTS’s saga 
includes its two earlier divorces, first from IS, then the Islamic State in Iraq and 
Syria/ Levant (ISIS/ISIL), and second from AQ. Its history, along with its ideological 
feud with THD, is documented in the works of the likes of Lister, Hamming, Al-Tamimi, 
and J oscelyn. 1 


The Syrian AQ veteran Samir Hijazi (a.k.a., Abu Hammam al-Suri) is the general leader 
of THD.“ Abu Hammam and members of his Shurah (Consultative) Council are 
believed to have been central to the establishment of THD.” This Council is thought to 


7 Lister (June 1, 2018). 

8 Ibid. 

9 To review the context that led to the formation of HTD, see, for example: Lister (2018) and Hamming 
and Ostaeyen (2018). 

10 Lister (2018); Tore Refslund Hamming and Pieter Van Ostaeyen, “The True Story of al-Qaeda’s Demise 
and Resurgence in Syria,” Lawfare, April 8, 2018, https://www.lawfareblog.com/ true-story-al-qaedas- 
demise-and-resurgence-syria; Tore Hamming, “How Turkey and the election of Erdogan are fragmenting 
the Jihadi movement,” Jihadica, J uly 6, 2018, http:// www.jihadica.com/how-turkey-and-the-election-of- 
erdogan-are-fragmenting-the-jihadi-movement/; Thomas Joscelyn, “Jihadists form ‘Guardians of the 
Religion’ organization in Syria” FFD’s Long War Journal, March 4, 2018, 
https:// www.longwarjournal.org/ archives/ 2018/ 03/ jihadists-form- quardians- of-the-religion- 
organization-in-syria.php; Thomas Joscelyn, “Analysis: Jihadists in Syria react to Sochi agreement,” 
FDD's Long War Journal, October 16, 2018, 
https:// www.longwarjournal.org/ archives/ 20 18/ 10/ analysis-jihadists-in-syria-react-to-sochi- 
agreement.php; Thomas J oscelyn, “2 al Qaeda leaders reject proposed military council in Syria,” FDD’s 
Long War Journal, January 30, 2019, https://www.longwarjournal.org/ archives/ 2019/01/2-al-qaeda- 
leaders- rej ect-proposed-military-council-in-syria.php; Aymenn Al-Tamimi, “ The Hay'at Tahrir al-Sham- 
al-Qaeda Dispute: Primary Texts (VII),” Pundicity, January 30, 2019a, 
http:// www.aymennjawad.orq/ 2019/ 01/ the-hayat-tahrir-al-sham-al-qaeda-dispute-primary-6; Aymenn 
Al-Tamimi, “The Hay'at Tahrir al-Sham-al-Qaeda Dispute: Primary Texts (VIII),” Pundicity, February 3, 
2019b, http://www.aymennjawad.org 2019/ 01/ the-hayat-tahrir-al-sham-al- qaeda-dispute- primary-7; 
Aymenn Al-Tamimi, “The Hay'at Tahrir al-Sham-al-Qaeda Dispute: Primary Texts (IX),” Pundicity, 
February 5, 2019c, http://www.aymennjawad.orq/ 2019/ 01/ the- hayat-tahrir-al- sham-al-qaeda- dispute- 
primary-8; Aymenn Al-Tamimi, “The Hay'at Tahrir al-Sham-al-Qaeda Dispute: Primary Texts (X),” 
Pundicity, February 6, 2019d, http://www.aymennjawad.org/ 2019/ 01/the- hayat-tahrir- al-sham-al- 
qaeda-dispute-primary-9; Aymenn Al-Tamimi, “ The Hay'at Tahrir al-Sham-al-Qaeda Dispute: Primary 
Texts (XI),” Pundicity, February 6, 2019e, http://www.aymennjawad.org/ 2019/ 01/ the-hayat-tahrir-al- 
sham-al- qaeda-dispute-primary- 10. 

11 Hamming and Van Ostaeyen (2018). 

£ Ibid. 


THE ISLAMIC STATE’S EFFORT TO CO-OPT TANZIM HURRAS AD-DIN | 5 


ALMOHAMMAD | PROGRAM ON EXTREMISM 


be made of diehard AQ loyalists like, for example, Sami al-Uraydi (a.k.a, Abu 
Muhammad al-Shami), Bilal Khuraysat (a.k.a., Abu Khadija al-Urduni), and Khalid al- 
Aruri (a.k.a., Abu al-Qassam al-Urduni). Furthermore, THD is made up of a number of 
jihadi insurgent groups, including, in no particular order, the following factions: J aish 
al-Sahil, Saraia al-Sahil, Jaish al-Malahim, Jaish al-Badiya, Jund al-Shariah, and 
Saraia Kabul. A study suggested that such mergers put the number of THD members 
between 2,000 and 3,000.6 However, this estimate should be scrutinized since the 
study did not detail its source(s) and method(s).1” 


Based on a source from the Iraqi security services, THD’s expansion efforts included the 
Iraqi provinces of Salah al-Din, Diyala, Kirkuk, and Nineveh in Iraq.!8 The source also 
alleged that THD aligned itself with Jaysh Rijal at-Tariqa an-Naqshabandiya (a.k.a. 
Army of the Men of the Naqshbandi Order), members of the jihadi current in Iraq, and 
“received the support of influential Iraqi political parties” in former IS strongholds.!9 
That report concludes by downplaying the potential of THD in Iraq. While the author 
could not ascertain the credibility of most of these claims, other sources seem to confirm 
THD’s ambitions in Iraq. For example, two press articles reported, based on Iraqi 
military sources, that Iraqi Special Forces intercepted and killed dozens of THD and IS 
operatives while en route from Al-Bukamal, Deir ez-Zor in eastern Syria to the southern 
parts of Anbar province, Iraq.2° These reports did not provide detail on why THD and IS 


33 Charles Lister, “US Officials J ust Mislabeled a Syrian Terror Group as al Qaeda. Worse, They’re Missing 
a Far Bigger Threat,” Defense One, June 1, 2018, https:// www.defenseone.com/ideas/ 20 18/ 06/ us- 
officials-just-mislabeled-syrian-group-al-qaeda- worse-theyre- missing: far- bigger-threat/ 148656/ . 

14 Hamming and Van Ostaeyen (2018). 

15 Hamming and Van Ostaeyen (2018). 

16 Hamming and Van Ostaeyen (2018). 

17 Tt is noteworthy that another report, based on a single unnamed source, estimated that the HTD is made 
of about 2,000 members: Sultan Al Kanj, “Jihadist In-fighting and the Birth of Horas ad-Deen,” Chatham 
House, April 2018, https://syria.chathamhouse.org/ research/ jihadist-in-fighting-and-the-birth- of-horas- 
ad-deen. 

18 Hassan al-Saidi, “Is Iraq’s ‘Guardians of Religion’ aiming for a ‘Sunni region’?,” Al Arabiya English, 
January 2, 2019, https://enqlish.alarabiya.net/ en/features/2019/01/ 02/Iraq-Guardians-of-Religion- 
seeks-to-establish-a-Sunni-region.html. 

19 Thid. 

20 Al Wafd, “Translation: The Prime Minister of Iraq Orders Sending Special Forces to Safeguard the 
Borders with Syria ,” Al Wafd, October 29, 2018, https://alwafd.news/ 
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members operated alongside each other.2! Nevertheless, the two articles indicated that 
one of the captured terrorist’s confessions led the Iraqi Special Forces to identify and 
confiscate arms from a warehouse that belonged to THD and IS.22 This author could not 
substantiate the credibility of these reports. 


Soon after it announced its formation in northwest Syria, THD insurgent activities 
against the Syrian regime and its backers expanded to the coastal region of west and 
west-central Syria.23 In late April 2018, in the 129 issue of al- Naba, IS' newsletter, the 
group declared takfir (excommunication) on THD.”4 Following this denouncement from 
IS and in light of increased assassination campaigns against THD members, using 
methods like car bombings and motorcycle assassinations, subsequent reports alleged 
that IS was covertly eliminating members of THD.2° While the author does not have 
evidence that confirms IS involvement in these particular assassinations, the findings 
suggest that IS is a likely suspect. 


Moreover, THD and Ansar al-Tawhid formed an alliance called Hilf Nusrat al-Islam 
(Alliance for the Support of Islam), on April 29, 2018.26 The United Nations Security 
Council confirmed the two insurgent groups’ merger.2” Ansar al-Tawhid is suspected to 
be a formation of J und al-Aqgsa.28 HTS alleged, based on its investigation, that J und al- 
Aqsa is an IS front organization.29 This front group is believed to have been formed by 
IS to eliminate HTS’s foreign fighters and to deter future recruitment. 30 


21Tbid. 

22 Thid. 

23 Brian Perkins, “Syria: Al-Qaeda Looks to Revive its Fortunes,” Terrorism Monitor 16, issue 16 (2018), 
https://jamestown.org/ wp-content/ uploads/ 2018/08/TM-Aug.-10-2018-Issue-.pdf?x87069. 

24 Al-Naba, issue (129), April 27, 2018. 

25 Hage Ali (2018). 

26 Maxwell Markusen, “Idlib Province and the Future of Instability in Syria,” CSIS Briefs, September 21, 
2018, https://www.csis.org/ analysis/ idlib-province-and-future-instability-syria. 

27 Security Council, “Twenty-second report of the Analytical Support and Sanctions Monitoring Team 
submitted pursuant to resolution 2368 (2017) concerning ISIL (Da’esh), Al-Qaida and associated 
individuals and entities,” United Nations, August 13, 2018, https:// undocs.org/ en/ S/ 2018/705. 

28 Thomas J oscelyn, “Al Qaeda-linked operations room continues to attack Assad regime,” FDD’s Long 
War Journal, November 19, 2018, https://www.longwarjournal.org/ archives/ 2018/ 11/ al-qaeda-linked- 
operations-room-continues-to-attack-assad-regime.php. 

29 The results of this HTS’s internal investigation are available on https://justpaste.it/y23n. 

30 Lister (2018). 
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That said, under the umbrella of Hilf Nusrat al-Islam and overt support to AQ 
leadership and method, THD improved its once purportedly weak organizational assets, 
overall structure, and operational capacity.31 Interestingly, the reported improvement in 
THD’s institutional capacity coincides with an IS covert operation to co-opt THD. Before 
presenting evidence on this covert operation and the profile of the IS operative at the 
heart of this multi-staged plan, it is it prudent to provide detail on the guiding method. 


Method 


This effort employs data from a larger project to gather primary source materials on IS 
operations in Syria. In particular, it draws on audio-visual data and interview materials 
gathered by 11 professional data collectors between January 3, 2018 and April 27, 
2019.32 This paper uses the method of tribe building to gain access to primary source 
materials outside of open source. Tribe building reflects research settings in which 
investigators become part of interconnected local networks of individuals and groups 
that are equipped with the skills and aptitude to gain access, deal with risk, and share 
data in hard to reach localities such as warzones.*3 


Over the course of three years, the author built these ‘trust networks’ and trained 
individuals within these networks with varying methods of sampling and targeted data 
collection. Trust is critical and a necessary prerequisite to engaging in such data 
gathering efforts, “as informants are more likely to share information with those they 
have come to know and trust.”35 The author took an incremental approach to tribe 
building and did so through establishing, running, exiting, and returning to networks of 
informants. For instance, this paper relies on data from three networks of informants. 


31] oscelyn (March 4, 2018, August 13, 2018, and J anuary 30, 2018); Hamming and Ostaeyen (2018); and 
Hamming (2018). 

32 The data collectors were trained by and have worked with the author on a number of projects in the 
past. They were tasked by their organizations to collect data on IS operations in Syria during the collection 
period. 

33 Malejacg and Mukhopadhyay (2016). 

34 Tilly, Charles. Trust and Rule (Cambridge: Cambridge University Press, 2015). 

35 Malejacg and Mukhopadhyay (2016): P.1017. 
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The author entered the first network in J anuary 2018. The author exited this network of 
six informants in September 2018. The five other informants were part of two networks 
that were entered in August 2018 and exited gradually by April 2019. 


The data collectors or informants gave their consent to participate in the study on the 
conditions of rigorous internal and external confidentiality measures. The data 
collectors are engaged in gathering information on insurgent groups on behalf of their 
employers. They stressed that data gathering for their employers is their priority and 
that they only share data outside of the scope of collection for their employers. The data 
that emerged from the field were translated, catalogued, and cross-checked against 
propaganda materials and documentary evidence during the same time period. The data 
were anonymised, date tagged, and stored in terms of individual data entries. Each data 
collector was given an alphanumerical code (DC01 through DC011). 


Efforts were made to remedy tribe building’s associated caveats and optimize the 
validity and reliability of the date while maintaining its integrity. Notwithstanding that 
tribe building gives unique ‘ground truth,’ the method necessitates considering the 
asymmetric distribution of power between the researcher and informants as well as 
issues of impartiality.36 In the process of collaborative sense-making in warzones, 3” 
informants are more powerful than the investigator and the relationship between the 
two parties is best described as symbiotic in which each party has the power to alter the 
scope of data gathering.3° It is noteworthy, however, that informants hold the ultimate 
power in shaping and limiting the scope of data collection. In this dyad,°9 the flow of 
information is subjected to the symbiotic back-and-forth wherein informants have a 
higher degree of autonomy. Impartiality is almost impossible in the context of studying 


36 Tid. 

37 Haar, Gemma Van Der, Annelies Heijmans, and Dorothea Hilhorst. 2013. “Interactive Research and the 
Construction of Knowledge in Conflict- Affected Settings.” Disasters 37, (1): 20- 35. 

38 Cassell, Joan. 1980. “Ethical Principles for Conducting Fieldwork.” American Anthropologist 82, (1): 
28-41; and Adams, Laura L. 1999. “The Mascot Researcher.” J ournal of Composite Materials 33, (10): 
928- 40. 

39 Diphoorn, Tessa. 2012. “The Emotionality of Participation: Various Modes of Participation in 
Ethnographic Fieldwork on Private Policing in Durban, South Africa.” Journal of Contemporary 
Ethnography 42, (2): 201- 25. 
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terrorist organizations in warzones.*° Neither the investigator nor the informants are 
impartial to the observed subjects of the study. For one, working with informants who 
are affiliated with or sympathetic to the Islamic State is impractical, dangerous, and 
illegal. This is a limitation that field researchers must reckon with when studying 


terrorist organizations. 


In the effort to maximize confidentiality, a set of information about the informants and 
their subject(s) is kept private.4! To this effect, all details that increase the odds of the 
informants being identified by other informants and their subjects were removed (i.e., 
internal confidentiality).42 Examples of these details include names, titles, aliases, and 
quotes from active and deceased members of the Islamic State. While snowball sampling 
can increase social infiltration of studied subjects,43 the data collectors were instructed 
to abstain from using the method as it may compromise internal confidentiality. 
Moreover, idiosyncratic details, including but not limited to, the locations and ethnic, 
cultural, and professional backgrounds of the informants were removed to preserve 
external confidentiality and eliminate the odds of deductive disclosure.“ It is 
noteworthy that to facilitate the review process, the data collectors agreed to share the 
raw data with the review team. 


Furthermore, a number of measures were employed to improve the validity of the data 
and findings, including triangulation, contradictory evidence, constant comparison, and 
respondent validation.45 By means of triangulation, the author combined different 
methods and data (i.e., documentary evidence collected in-theater and open source 


40 Fine, Gary Alan. 1993. “Ten Lies of Ethnography: Moral Dilemmas of Field Research.” Journal of 
Contemporary Ethnography 22, (3): 267- 94. 

41 Benjamin Saunders, J enny Kitzinger, and Celia Kitzinger, “Anonymising interview data: Challenges and 
compromise in practice,” Qualitative Research 15, 5 (2015): pp. 616-632. 

42 Martin Tolich, “Internal Confidentiality: When Confidentiality Assurances Fail Relational Informants,” 
Qualitative Sociology 27, 1 (2004): pp. 101-106. 

43 Peritore, N. Patrick. 1990. “Reflections on Dangerous Fieldwork,” The American Sociologist 21, (4): 
359- 72. 

44 Alexander Tsai, Brandon Kohrt, Lynn Matthews, Theresa Betancourt, Jooyoung Lee, Andrew 
Papachristos, Sheri Weiser, and Shari Dworkin, “Promises and pitfalls of data sharing in qualitative 
research,” Social Science & Medicine 169 (2016): pp. 191-198. 

45 Anderson, Claire. "Presenting and evaluating qualitative research." American journal of pharmaceutical 
education 74, no. 8 (2010): 141. 
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materials). Contradictory evidence or deviant cases, as long as they were accurate and 
objective, were sought out, retained in the data entries, and used in the interpretation of 
the findings. The data was not fragmented but rather viewed as one piece. The constant 
comparison of data entries allowed the author to identify unanticipated and emerging 
themes (e.g., elements of IS’ plan to co-opt THD). 


In order to minimize bias in the data, reduce the risk of exposing the informants, and 
maintain trust with them, they were not informed on the findings of other participants 
during the data collection phase. However, the data collectors were briefed on the data, 
analysis, and findings of an earlier draft of this paper to allow them to provide their 
feedback and, ultimately, improve respondent validity. The data collectors approved the 
used quotes and interpretation of the results. 


Last but not least, this endeavor adheres to ‘localized ethics;’ that is to say, an approach 
in which the investigator and informants share risk and responsibility.4° This approach 
acknowledges that the informants are best situated to determine the visibility and risk 
associated with data collection efforts.4’ Therefore, this paper recognizes informants’ 
assessment of the visibility and risk of data collection as the bases to limit the scope of 
data gathering. In other words, the author did not pursue data gathering on relevant 
issues when such efforts were deemed risky by the informants. The following pages 
provide detail on the leading operative behind IS' attempts to co-opt THD and 
subsequently discuss how these efforts can be seen as elements of a contingency plan to 
regroup and rebuild its organizational capabilities. 


46 Kovats-Bernat, J. Christopher. 2002. “Negotiating Dangerous Fields: Pragmatic Strategies for 
Fieldwork 

Mid Violence and Terror,” American Anthropologist 104, (1): 208- 22. 

47 Wood, Elisabeth J ean. 2006. “The Ethical Challenges of Field Research in Conflict Zones.” Qualitative 
Sociology 29, (3): 373- 86. 
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The First Wali of Raqqa 


Taha Subhi Falaha (a.k.a., Abu Muhammad al-‘Adnani), IS former spokesperson, is 
suspected to have been tasked with the group’s external intelligence operations.*® Such 
operations are managed by IS’ Directorate of General Security.49 However, even before 
al-‘Adnani’s death in 2016, a Syrian national by the name of Ali Musa al-Shawakh 
(a.k.a., Ali Juma al-Shawakh, Abu Lugman, Abu Ayoub al-Ansari/al-Suri, and Abu 
Adam) is reported to have been tasked with external operations as the amir of the 
Directorate of General Security.5° Moreover, there is evidence that al-Shawakh 
reconfigured the hierarchal design of the original amni forces’ (Directorate of General 
Security) organizational structure sometime in mid-2016.5' This organizational 
reconfiguration gave al-Shawakh’s directorate enough power to dominate a wide array 
of IS’ operations, including heavy oversight over IS’ Central Media Directorate. 


Born in 1973 in Sahl village in Raqqa province, Syria, al-Shawakh would rise to 
prominence in the ranks of the IS organization. He is a former student of Aleppo 
University’s law department. Among other things, al-Shawakh is suspected to have 


48 Rukmini Callimachi, “How a secretive branch of ISIS built a global network of killers,” New York Times, 
3 August 2016, http:// www.nytimes.com/ 20 16/ 08/04/ world/ middleeast/ isis- german-recruit- 
interview.html?_r=0. 

49 Asaad Almohammad and Charlie Winter, “From Directorate of Intelligence to Directorate of 
Everything: The Islamic State’s Emergent Amni-Media Nexus,” Perspectives on Terrorism 13, no. 1 
(2019). 

50 Security Council, “Security Council ISIL (Da’esh) and Al-Qaida Sanctions Committee Adds 12 Names to 
Its Sanctions List,” Security Council: SC/ 12266, 29 February 2016, 
https:// www.un.org/ press/ en/2016/sc12266.doc.htm; U.S. Department of the Treasury. “Treasury 
Sanctions Major Islamic State of Iraq and the Levant Leaders, Financial Figures, Facilitators, and 
Supporters,” U.S. Department of the Treasury, September 29, 2015. https://www.treasury.gov/ press- 
center/ press-releases/ Pages/jl0188.aspx; and U.S. Department of the Treasury, “Counter Terrorism 
Designations,” Office of Foreign Assets Control, September 29, 2015, https:// www.treasury.gov/ resource- 
center/ sanctions/ OFAC- Enforcement/ Pages/ 20 150929.aspx. 

51 Author interview with DC05, October 3, 2018; Author interview with DC06, October 19, 2018; Author 
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Provinces,” Jihadology, 2 August 2017, http://www.aymennjawad.org/20129/ the-archivist-the-islamic- 
state-security. 
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been involved with a late Syrian facilitator of jihadi travelers between Syria and Iraq in 
the early days of the Iraq war. This deceased facilitator, Mahmoud Qul Aghassi (a.k.a., 
Abu al-Qaqaa), was believed to be an ally of the Syrian regime’s security forces.56 That 
said, a number of accounts suggest that al-Shawakh spent time in Saidnaya Prison, an 
infamous Syrian military detention facility where Islamist prisoners were trained and 
sent to join insurgent groups fighting American forces in Iraq after the fall of Saddam’s 
government.°” However, the duration of al- Shawakh’s captivity and whether he traveled 
to Iraq between 2003 and 2010 remain unclear. 58 


Nevertheless, there seems to be an agreement that, like other key Syrian Islamist and 
jihadi leading figures, al-Shawakh was released from Saidnaya Prison by the Syrian 
regime during the early months of the Syrian crisis in 2011.59 Sometime after his release, 
he joined Jabhat al-Nusra, and, at some point, became the second-in-command in 
Raqqa, subordinate only to Abu Saad al-Hadrami. In J anuary 2014, al-Shawakh either 
carried out a planned plot to coerce J abhat al-Nusra’s operatives in Raqqa to join the 
ranks of IS, then ISIS, or displayed his allegiances to Ibrahim al- Badri (a.k.a., Abu Bakr 
al-Baghdadi), the leader of IS and its two former iterations, by killing his Jabhat al- 
Nusra superior, al- Hadrami.® By all accounts, al- Shawakh became IS’s first wali (ruler) 
of its former de facto capital.6! He was assigned to this significant role after being 
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56 For more details on Abu al-Qaqaa, please see: Fishman, Brian, The Master Plan: ISIS, Al Qaeda, and 
the Jihadi Strategy for Final Victory (New Haven: Yale University Press, 2017); Joby Warrick, Black 
flags: The rise of ISIS (New York: Anchor, 2015); and Michael Weiss and Hassan Hassan, ISIS: Inside the 
Army of Terror - updated edition (New York: Simon and Schuster, 2016). 
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charged with leading IS’ Syria branch of the Directorate of General Security. That 
position allowed al-Shawakh to oversee “combat assignments for foreign fighters,” 


Wt 


‘ISIL’s detention of foreign hostages,” “the appointment of other ISIL leaders,” and 
“security matters, including executions, interrogations, and transfers of... prisoners.”62 
Additionally, as of mid-2014, he was a member of “a governance council chaired by” al- 


Baghdadi.® 


A report following the elimination of al-‘Adnani from the battlefield, based on the 
accounts of IS deserters, argued that al-Shawakh and al-‘Adnani did not see eye to eye 
regarding war conduct in Syria and that due to their frequent quarrels al-Baghdadi 
transferred al-Shawakh to Iraq.6t However, it seems that al-Baghdadi tried to resolve 
the reported tension between two of his top lieutenants.® It appears that al-Shawakh 
was transferred to Iraq®® but not before outmaneuvering al-‘Adnani by limiting his 
power before the latter was finally killed.6” Around that time, al-Shawakh was predicted 
to become the next IS spokesperson.®8 He did not. After the reported death of U.S. 
Master Sgt. Jonathan J. Dunbar and U.K. soldier Sgt. Matt Tonroe, while on a classified 
joint mission to ‘kill or capture a known ISIS member,’69 some questioned whether al- 
Shawakh was the target.” It is unclear whether he was. A year before silencing the 
infamous mouthpiece of IS (al-‘Adnani), al-Shawakh was viewed as a possible Wali al- 
‘Ahd (successor) of al-Baghdadi.7”! IS did not, at least publicly, name any successor to al- 
Baghdadi. Media reports, based on Iraqi intelligence sources, claimed that he had been 
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68 Schmitt et al. (2016); and Khalaf (2016). 

69 Barbara Starr, “US and British soldiers killed in Syria were on ISIS 'kill or capture’ mission,” CNN, April 
2, 2018, https:// edition.cnn.com/ 2018/04/ 02/ politics/ us-british-soldiers- killed-syria-isis- kill- 
mission/ index.html. 
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eliminated a number of times.” The latest of these unconfirmed killings was on April 
23, 2018.73 Interview materials, suggest that he was not killed.“ 


Described as “one of al-Baghdadi’s trusted confidants,” al-Shawakh’s portfolio is 
extensive.” As suggested, he was transferred to Iraq before the elimination of al- 
‘Adnani; 76 it seems that he led an operation to exfiltrate senior IS operatives from Iraq 
and handled key security functions in anticipation of the loss of IS territories in Iraq.” 
Traveling with a small number of security operatives, al-Shawakh appears to have been 
able to make it there and back from Iraq before Mosul’s liberation.”8 Constantly on the 
move between north, central, and west Syria, among a few of al-Baghdadi’s top 
lieutenants, 7 he was charged with restructuring the IS organization sometime between 
the liberations of Mosul and Raqqa.®° This was possibly to reconfigure its institutional 
bureaucracy into a form of organizational adhocracy,®! one that would facilitate the 
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transition to a covert insurgency and improve the use of guerrilla warfare methods. 82 
Around that time, al-Shawakh assigned a new director to oversee security-related 
matters in Wilayat al-Khair (IS-held territories in Der ez-Zor: this branch is known as 
Security Post/ Point 13) before finally managing to oust that region’s ruler, replacing him 
with one of his subordinates and loyalists.8° Topping all of this off, al-Shawakh, under 
al-Baghdadi’s directives, handpicked three ‘judges’ to oversee al-Lajnah al-Mufuthah 
(the Delegated Committee) and a certain Monitoring Committee, placing him at the 
heart of ideological schism within the ranks of IS.84 With this brief examination of al- 
Shawakh’s profile, the following section details, among other things, his key role in the 
operation to infiltrate and co-opt THD. 


A Contingency Plan 


In short, between early J une and late J uly 2016, HTS, then J abhat al-Nusra, initiated a 
process to untie itself from AQ and to rebrand itself into J abhat Fateh al-Sham.®° In late 
January 2017, this former Syrian AQ affiliate announced a merger with several Syrian 
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Islamist groups, rebranding itself again and this time as HTS.®6 In so doing, HTS broke 
away from AQ and displayed a ‘friendlier’ attitude towards Turkey’s foreign policy and 
its ruler.8” This strategic shift, from the time of initiating the breakup with AQ, has 
antagonized and still agitates AQ’s ideologues and loyalists in Syria and beyond.®® This 
is the context, albeit very brief and incomprehensive,®9 that led to the announcement of 
THD’s formation in February 2018, a process that was initiated no later than mid- 
January 2017.99 And IS was involved in the process of establishing THD from the very 


beginning.?! 


Operating through the Unified Security Center, al-Shawakh’s brainchild,9* and in 
collaboration with an institution known as Diwan al-Khilafa (Caliphate Directorate), 
al-Shawakh orchestrated the operation to co-opt THD.% Quick to capitalize on the 
intention of AQ loyalists to split from the previous iteration of HTS and form a new 
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and Author interview with DC05, February 6, 2019. 
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jihadi group, sometime before mid-J anuary 2017 al-Shawakh commissioned the leader 
of his organization’s sleeper cells in HTS, a certain Muhammad ‘Adnan al-Abuathi, with 
establishing a sufficient security, media, and administrative infrastructure for THD.95 
Under IS directives, these institutions were to be led by IS operatives and/or AQ 
loyalists who were willing to offer Bay’a (pledge of allegiance) to IS’ leader, albeit 
secretly.9° This tactic was employed throughout the establishment phase and remained 
enforced after the announcement of THD’s formation.9” 


As IS realized the inevitability of territorial defeat, Al-Shawakh transferred his top 
lieutenant, a certain Muhammad Abdul Karim al-Thahir (a.k.a, Abu Musab), to 
expedite the operation to co-opt members of THD months before the group announced 
its formation. Al-Thahir was charged with overseeing an IS special security unit that 
worked on securing the pledge of allegiances to al-Baghdadi from AQ loyalists who had 
participated in the establishment of THD.99 He was the leading figure of the department 
of external operations of IS’ security apparatus as of early February 2019.10 According 
to the description of the duties and responsibilities of this department, 8! al-Thahir 
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might have been involved in an IS security operation that led to the killing of more than 
sixteen people, including four Americans, in Manbij, Syria. 12 


Al-Shawakh’s directives to al-Thahir before the announcement of the formation of THD 
were Clear: 3 Flip AQ loyalists, and if you cannot flip them, kill them. 14 As well as this, 
al-Thahir was charged with overseeing the recruitment of locals from greater Idlib. 15 It 
appears that he had overachieved regarding these missions, £6 managing to “recruit a 
number of operatives who were able to climb Hurras al-Din’s hierarchy.” 107 In brief, this 
element of the operation focused on eliminating any threat, recruiting key AQ loyalists, 
and providing support and directives to new recruiters. 108 


Right from the start in mid-J anuary 2017, IS invested in structuring and building THD’s 
organizational capacity. !°9 Central to this effort was establishing both a strong security 
apparatus and a strong media office to be led by, managed by, and made up of IS 
loyalists. 1° At the time, IS worked on establishing THD, "! with a general goal to co-opt 
it at a certain point. This undertaking aimed to guarantee an expedited process for “the 
establishment of a sufficient infrastructure to tackle real estate [matters], financial 
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affairs,” and the recruitment of trained “administrative personnel” to run educational 
institutions, oversee sharia affairs, and manage detention facilities." As well as the 
aforementioned operations, IS relocated essential security and media personnel to 
improve THD’s capacity and train its cadres. 18 These IS-orchestrated capacity- building 
efforts, recruitments, and assassinations did not stop with the announcement of THD’s 
formation. 14 Throughout the establishment and formation of THD, IS used its agents 
and resources to configure THD’s organizational structure in a manner that facilitates 
merging the two groups’ assets and aligns their modes of operation. 5 It is unclear now 
whether IS succeeded or is still running the operation to co-opt THD. This author could 
not find evidence to examine the depth, or lack thereof, of IS co-optation of THD’s 
Consultative Council, the organization’s most senior leaders. 116 


Sometime before August 2018, from the northern vicinity of the town of Abu Al- Khater, 
Deir ez-Zor, IS used an office by the name al-Maktab al-Amni la-Ansar al-Jihad (the 
security office for the supporters of jihad),"’ a subordinate office of the IS’ Unified 
Security Center, 18 to collaborate with members of THD." This office is likely behind 
the joint IS and THD operation intercepted on the borders between Syria and Iraq 
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around that time. £0 According to the author’s research, if confirmed, this marks the first 
detected joint operation/ collaboration between members of IS and THD. 


In the weeks running up to its territorial collapse, IS negotiated for “safe passage to the 
Syrian province of Idlib” £1 with the Syrian Democratic Forces through an IS division by 
the name Point/ Post 11.2 Post 11 overlaps with the central command and control and 
administrative authority of IS security forces. 2° Then, IS asked for safe passage to Idlib, 
the operational sphere of THD. It appears that by early February 2019, IS had already 
enforced certain measures of organizational alignment between itself and THD”4 and 
invested in establishing a new faction to facilitate a potential merger. 25 According to the 
journalist Rukmini Callimachi, the deal to grant IS safe passage to Idlib was “on the 
table.”26 A local report signaled that IS and the allied forces reached a deal, granting IS 
such safe passage. 27 However, on February 10, 2019, US-backed forces resumed their 
effort to oust IS from its last sliver of land in east Syria.28 On March 23, 2019, the 
Syrian Democratic Forces liberated Baghuz, IS’ last occupied town in Syria. £29 
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21 Rukmini Callimachi, “A Desperate Exodus From ISIS’ Final Village,” The New York Times, February 6, 
2019, https:// www.nytimes.com/ 20 19/ 02/ 06/ world/ middleeast/ isis- baghuz.html. 
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Based on the accounts of regional intelligence officials, a report uncovered an attempted 
coup to kill al-Baghdadi by a foreign element of his own terrorist organization. {180 
However, the timing of this coup attempt, January 10, 2019,81 was reported to have 
happened months earlier, sometime in late 2018.82 In any case, it seems that the 
attempt on al-Baghdadi’s life followed a meeting with his top lieutenants. 83 Moreover, 
during the meeting, IS’ leader and his top operatives discussed a few regrouping 
contingencies, including the Syrian-Iraqi border, the Syrian Desert in the south of the 
country: and Idlib.34 It was agreed that whenever IS lost its last remaining footholds in 
eastern Syria, a network of sleeper cells, under the leadership of a faction by the name 
Jaish al-Amniyin (the army of security forces), would start its operations in IS’ former 
strongholds across Syria.>5 A similar pattern was observed in Iraq through the last 
months of 2018.86 Advisors from IS security forces appeared to favor regrouping and 
rebuilding the organization’s depleted capabilities in Idlib, presenting it as the 
organization’s best option. £87 The plan, should IS’ remnants make it to Idlib, “is to move 
to [THD] strongholds, keep recruiting AQ loyalists,” and, whenever the timing was 
deemed appropriate, “fold [the jihadi group] under [its] banner.” 138 


Conclusion 


Two recent official assessments suggest that IS still leads thousands of dispersed battle- 
hardened fighters in Syria and Iraq, as well as commanding eight branches, overseeing 
the operations of over a dozen networks, and thousands of supporters around the 
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globe.89 These reports argue that a reduction in counterterrorism efforts to defeat IS 
may allow the terrorist organization to regroup and rebuild its depleted capabilities. 140 
These concerns were echoed by Gen. Joseph Votel, the commander of U.S. Central 


Command. 141 


The findings presented here provide further support to these assessments. It appears 
that IS has plotted a contingency plan to regroup and facilitate accelerated capacity- 
building. It has done so in a clandestine fashion for over two years. The operation to 
infiltrate and build the capacity of THD, recruit from AQ’s jihadi constituency, eliminate 
potential threats, and enforce measures of organizational alignment between the two 
groups is a testament that IS leadership, despite significant losses, was still able to 
orchestrate sophisticated covert operations. That said, it is hard to determine the 
effectiveness of IS’ co-optation of THD and whether this operation is still active or has 
reached its desired outcome. Such assessments still require further investigation. 

This effort evidences the insight gained from primary data collection and tribe building. 
Such methods stand to provide critical details on insurgent groups. However, 
notwithstanding that different means of optimizing the validity of the data—like, for 
example, triangulation, contradictory evidence analysis, and respondent validation— 
were used, this endeavor relies on human sources and thus, it is bound to suffer from 
associated caveats. That said, it is the hope of this author that the findings of this 
investigation will improve academics’ and practitioners’ understanding of this enemy 
menace and allow them to use appropriate methods for assessing its capabilities and set 
better-informed policies to degrade its assets. 
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